Privacy Notice
Last updated: 1 May 2026
This Privacy Notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and applicable national legislation (Bulgarian Personal Data Protection Act / ЗЗЛД; Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018) and describes how Eternal Touch processes personal data collected through the website eternaltouch.it.
1. Identity of the Data Controller
The Data Controller is:
Carbon Stealth VCC — operating under the trade name "Eternal Touch"
Company ID (EIK): BG208725180
Registered office: Ul. Samuil 3, 2670 Bobov Dol, Bulgaria
E-mail: info@eternaltouch.it
Website: eternaltouch.it
Carbon Stealth VCC is a Bulgarian company, registered with the Bulgarian Commercial Register at the Registry Agency. For any data-protection enquiries, please contact the Controller using the above details. A Data Protection Officer (DPO) has not been appointed under Art. 37 GDPR, as the statutory thresholds do not apply.
2. Personal data we collect
We process the following categories of personal data:
2.1 Data voluntarily provided by the user
Through the contact form we collect: name, e-mail address, phone number (optional), subject and message content. Provision is voluntary, but without it we cannot reply.
2.2 Data collected automatically
- IP address — used solely for approximate geolocation in order to display the appropriate language (Italy → Italian; Bulgaria → Bulgarian; other countries → English). The IP address is not persistently stored linked to a profile.
- Server technical logs — date/time, requested URL, response code, user-agent. Retained for security and diagnostic purposes.
- Technical cookies — see our separate Cookie Policy.
3. Purposes and legal bases for processing
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Reply to enquiries via contact form | Art. 6(1)(b) — pre-contractual measures / Art. 6(1)(f) — legitimate interest | 24 months |
| Geolocation for language display | Art. 6(1)(f) — legitimate interest in correct UX | No retention (instant use) |
| Site security and abuse prevention | Art. 6(1)(f) — legitimate interest | Logs: 12 months |
| Technical cookies (session, language preference, consent) | Art. 6(1)(f) — legitimate interest / ePrivacy exemption | Session / up to 12 months |
| Analytics & marketing cookies (if active) | Art. 6(1)(a) — consent | Per individual cookie settings |
| Compliance with legal obligations (tax, judicial orders) | Art. 6(1)(c) — legal obligation | Period required by applicable law |
4. Recipients and processors
Personal data may be disclosed to:
- Authorised personnel of Carbon Stealth VCC and its collaborators, bound by confidentiality obligations.
- Hosting and infrastructure providers — the site is hosted on a dedicated VPS server located in the European Union, managed directly by the Controller.
- Google LLC — limited to the Google Fonts service for delivering typographic fonts. This service loads fonts from Google's servers, which entails the transmission of the IP address. See section 5.
- Judicial and regulatory authorities where required by law.
External providers acting as Data Processors are appointed pursuant to Art. 28 GDPR.
5. International data transfers
Personal data is processed and stored within the European Economic Area (EEA). The use of Google Fonts may involve a transfer of data (IP address) to Google LLC servers located in the United States. Such transfer is based on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and/or Google's adherence to the EU-U.S. Data Privacy Framework. The user may disable external fonts via browser settings.
6. Retention periods
Data is retained for the time strictly necessary for the purposes for which it was collected, as specified in section 3, and is then deleted or anonymised, except where statutory retention obligations apply.
7. Data subject rights
Pursuant to Articles 15–22 of the GDPR, the user has the right to:
- Access (Art. 15) — obtain confirmation of processing and a copy of personal data.
- Rectification (Art. 16) — obtain correction of inaccurate or incomplete data.
- Erasure (Art. 17, "right to be forgotten") — obtain deletion of data in the cases provided.
- Restriction (Art. 18) — request restriction of processing.
- Portability (Art. 20) — receive in a structured, machine-readable format the data provided.
- Objection (Art. 21) — object to processing based on legitimate interest.
- Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Not be subject to automated decisions (Art. 22) — the Controller does not carry out automated decision-making or profiling.
To exercise these rights, simply write to info@eternaltouch.it. We will respond within 30 days of receipt of the request (extendable by a further 60 days in particularly complex cases, with reasoned notice).
8. Right to lodge a complaint with a Supervisory Authority
If the user believes that the processing of their data infringes the GDPR, they have the right to lodge a complaint with the competent Supervisory Authority:
- Bulgaria — Commission for Personal Data Protection (КЗЛД) — www.cpdp.bg
- Italy — Garante per la protezione dei dati personali — www.garanteprivacy.it
- Or with the Supervisory Authority of the EU Member State of habitual residence, place of work, or place of the alleged infringement.
9. Children
The site is not directed to children under 16. We do not knowingly collect children's data. Should we become aware that we have processed data of a child without parental consent, we will promptly delete it.
10. Changes to this notice
This notice may be amended at any time. The updated version will be published on this page with the date of last update. In the event of material changes, we will provide notice on the website.
11. Contact
For any matter relating to the processing of personal data, please write to info@eternaltouch.it.